After the threads from @conspirator0 and @propornot re: @propornotapp (now suspended), decided to look for any interesting breadcrumbs they may have left behind. Wound up learning about #Nationalist parties of Bulgaria and a few other tidbits. #osint #bots #disinformation
First thing that turned up was this article from the site newsbeezer(.)com (site title: Bulgaria Evening News). As you can see in the screenshot, @PropOrNotApp is quoted discussing conditions during fires in neighboring Greece. Sure, why not? 
What else is on this site? Well, they appear to be big fans of the National Front for the Salvation of Bulgaria, normally abbreviated to NFSB, though oddly they seem to alternate the abbreviation between NFFS and NPSB. Neither appear affiliated with another political party.
The NFSB is a member of the current ruling coalition in Bulgaria, called the United Patriots. The United Patriots are aligned with the nominally Pro-EU GERB party but that position has lost some of its strength due to the alliance. Here’s a quick look at UP’s positions and makeup
So who’s behind this site? It’s hosted in the US by Namecheap and registered anonymously, but there’s a clue left in the Start of Authority or SOA DNS record: the email address rockpura786@gmail(.)com. This email is in two other domains records, vaaju(.)com and remonews(.)com
SOA, or Start of Authority, records are part of the system that allows you to type “google.com” instead of an IP address, known as DNS. This particular records tells you the contact for DNS problems. Since they’re using Namecheap with custom servers, that’s them.
Vaaju(.)com might have some slight bias behind it; remonews(.)com less obviously so, but not radically different. First pics are vaaju(.)com and second are remonews(.)com’s current headlines.
Remember the odd use of NFFS for the NFSB party? First relevant result found (nothing else seemed to be referencing a Bulgarian political party). Also they credit Descant as the author, which is the NFSB newspaper. Possibly avoiding detection of content scraping?
So far no additional information as to the identity of the person/organization using that email, but if anything else is found I’ll add it to this thread.
The @PropOrNotApp account stood out in tweets collected through May in this research paper for its use of the hashtag #fakenews, though they falsely believe it to be associated with the @propornot effort. blogs.oii.ox.ac.uk/policy/wp-cont…
Between the email address found in all three sites, the dates at which they went live (April 2018), common infrastructure (all use Namecheap and WhoisGuard), similar messaging, and reuse of website templates, the shared ownership of these sites is fairly obvious.
So the question is what if any affiliation exists between @PropOrNotApp and the creator of these sites? The account was created to spread mis/disinformation about people studying the same. Their being quoted by a site, one of a few run by the same person(s), pushing the type of
#Disinformation that @propornot works to expose seems suspicious but could be as simple as two like minded people, and the writer of this article followed @ProporNotapp. With the account suspended, I haven’t found the full text yet. If anyone wants to share, my DMs are open :)
Regardless the look into Kremlin-aligned far-right parties was interesting, and a good reminder that information is just weaponized against America; our friends and allies are under attack as well. So thank you to @conspirator0 and @propornot for a fun night!
All articles from thread (visit at your own risk, can’t guarantee there’s nothing malicious on them) newsbeezer.com/bulgariaeng/gr… newsbeezer.com/bulgariaeng/th… balkanist.net/bulgarias-far-…
Isn’t!!! @twitter please, flag em as such if you want, but give us a damn edit button!!!
